Adaptive anomaly detection method, system and device based on working condition characteristics and medium

Abstract

The application discloses a kind of based on working condition feature's self-adapting abnormality detection method, system, device and medium, method includes the following steps: S1, obtains working condition historical data, constructs the time series of working condition historical data;S2, the length of time series is obtained by Fourier change;If the length of time series is greater than 1, then enter step S3, if the length of time series is equal to 1, then enter step S4;S3, the time series of length greater than 1 is detected and the result is output by maximum average deviation;S4, the time series of length equal to 1 is detected and the result is output by local outlier factor.The application determines sequence length by Fourier transform.For sequence length greater than 1, maximum average deviation algorithm is used for abnormality detection.For sequence length equal to 1, local outlier factor algorithm is used for abnormality detection.Therefore, it solves the problem that abnormality detection sequence length is always determined according to empirical value in industrial production.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of working condition feature anomaly detection, and in particular to a self-adaptive anomaly detection method, system and device based on working condition features and a medium. BACKGROUND

[0002] In the chemical, power, steel, papermaking, textile and semiconductor industries, there are many anomaly detection scenarios. Some abnormal situations may reduce the yield of products, and in severe cases, may even cause equipment failure, thereby causing equipment damage.

[0003] Traditional anomaly detection methods often use fixed time windows or preset sequence lengths for data analysis, but there are significant limitations in complex scenarios in multiple industries. If the period is set too small, only fluctuations caused by sensor errors will be detected; if the period is set larger, some transient faults will be missed, which may have caused irreversible damage to some precision instruments. SUMMARY

[0004] To solve the above technical problems, the present application aims to provide a self-adaptive anomaly detection method based on working condition features. This method can automatically select a time window or sequence length for data analysis according to the working condition features, thereby discovering hidden abnormal situations.

[0005] The self-adaptive anomaly detection method based on working condition features of the present application comprises:

[0006] S1, obtaining working condition historical data and constructing a sequence of the working condition historical data;

[0007] S2, obtaining the length of the sequence through Fourier transformation; if the length of the sequence is greater than 1, proceed to step S3, and if the length of the sequence is equal to 1, proceed to step S4;

[0008] S3, performing anomaly detection on the sequence with a length greater than 1 through maximum average deviation and outputting the result;

[0009] S4, performing anomaly detection on the sequence with a length equal to 1 through local outlier factor and outputting the result.

[0010] Step S2 comprises:

[0011] S2.1, performing discrete Fourier transformation on the sequence composed of historical data, satisfying:

[0012]

[0013] wherein, is a discrete time domain signal, i.e. a sequence composed of original data, and N is the length of the sequence composed of original data; is a discrete sequence in frequency domain, representing the spectral component of the signal at frequency e is a natural constant, i is the imaginary unit;

[0014] S2.2, using the index value corresponding to the maximum value of the frequency domain signal mode as the sequence length, if the index starts from 0, using the index value plus 1 as the length of the time window or sequence;

[0015] S2.3, if the length of the sequence is equal to 1, go to step S4; if the length of the sequence is greater than 1, go to step S3.

[0016] Step S3 includes:

[0017] S3.1, combine the data into a sequence according to the sequence length obtained in step S2, for each time point t, take the data from t-freq to t to combine into a sequence, where freq is the sequence length obtained in step S2;

[0018] S3.2, calculate the maximum mean deviation value of the sequence to be detected and all other sequences, which satisfies:

[0019]

[0020] In the formula, is the sequence to be detected, is one of the other sequences except MMD is the maximum mean deviation, m is the length of the sequence obtained in S2.1; is the jth element in the sequence to be detected x, is the kth element in the sequence to be detected, is the jth element in the sequence is the kth element in the sequence ; is the kernel function;

[0021] S3.3, for the maximum mean deviation value of the sequence to be detected and other sequences, take the median as the final result;

[0022] S3.4, select the decision threshold by the length of the sequence , when the value of the maximum mean deviation exceeds the decision threshold , it is determined that the sequence has an anomaly, the decision threshold satisfies:

[0023]

[0024] wherein, is the decision threshold, m is the length of the sequence obtained in S2.1.

[0025] In step S3.4, the value of the maximum average deviation satisfies the range [0, 1].

[0026] In step S3.2, the kernel function satisfies:

[0027]

[0028] wherein, is a width parameter of the Gaussian kernel function, > 0.

[0029] Step S4 includes:

[0030] S4.1, selecting a neighborhood K;

[0031] S4.2, calculating the distance of the to-be-detected point and the Kth nearest neighbor of the neighboring point, satisfying:

[0032]

[0033] wherein, is the to-be-detected point, is the distance of the Kth nearest neighbor of the point to the nearest neighbor;

[0034] S4.3, calculating the reachable distance of the Kth nearest neighbor and the to-be-detected point , satisfying:

[0035]

[0036] wherein, is the jth nearest neighbor, is the distance of the Kth nearest neighbor of the point to the nearest neighbor;

[0037] S4.4, calculating the local reachable density, satisfying:

[0038]

[0039] wherein, is the reachable distance between the to-be-detected point and the jth nearest neighbor ;

[0040] S4.5, calculating the local outlier factor, satisfying:

[0041]

[0042] wherein, K is the size of the field, is the local reachable density of the to-be-detected point p; is the jth nearest neighbor local reachable density;

[0043] S4.6, determining the decision threshold , the decision threshold satisfies:

[0044]

[0045] S4.7, if LOF≈1, indicating that the to-be-detected point is similar to the neighbor density, it is determined to be normal data; if LOF>1, indicating that the to-be-detected point is lower than the neighbor density, it is determined to be abnormal data.

[0046] In step S4.1, the value of the neighborhood K satisfies the range [10, 100].

[0047] The adaptive anomaly detection system based on working condition characteristics comprises:

[0048] A collection module is configured to acquire working condition historical data and construct a sequence of the working condition historical data.

[0049] A change module is configured to acquire the length of the sequence through Fourier change; if the length of the sequence is greater than 1, the sequence with the length greater than 1 is subjected to anomaly detection through maximum average deviation; if the length of the sequence is equal to 1, the sequence with the length equal to 1 is subjected to anomaly detection through local outlier factor.

[0050] A first detection module is configured to subject the sequence with the length greater than 1 to anomaly detection through maximum average deviation and output the result.

[0051] A second detection module is configured to subject the sequence with the length equal to 1 to anomaly detection through local outlier factor and output the result.

[0052] The adaptive anomaly detection device based on working condition characteristics comprises a memory storing an adaptive anomaly detection method program based on working condition characteristics and a processor configured to run the adaptive anomaly detection method program based on working condition characteristics, and the adaptive anomaly detection method program based on working condition characteristics is configured to implement the steps of the adaptive anomaly detection method.

[0053] The computer readable storage medium stores the adaptive anomaly detection method program based on working condition characteristics, and the processor executes the steps of the adaptive anomaly detection method based on working condition characteristics.

[0054] The application determines the sequence length by Fourier transform. The maximum average deviation algorithm is used for abnormality detection for the sequence length greater than 1, and the local outlier factor algorithm is used for abnormality detection for the sequence length of 1. Therefore, the problem that the sequence length for abnormality detection in industrial production is always determined according to experience value is solved. BRIEF DESCRIPTION OF DRAWINGS

[0055] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments with reference to the drawings.

[0056] Figure 1 The total flow chart of the adaptive abnormality detection method based on working condition characteristics of the embodiments of the application. DETAILED DESCRIPTION

[0057] The adaptive abnormality detection method based on working condition characteristics of the application will be further described below in combination with the drawings. In the following detailed description, certain exemplary embodiments of the application are described by way of illustration only. It is obvious for those skilled in the art that the described embodiments can be modified in various ways without departing from the spirit and scope of the application. Therefore, the drawings and the description are illustrative in nature and are not used to limit the protection scope of the claims.

[0058] There are many abnormality detection scenes in industrial production. For the above scenes, the application proposes an adaptive abnormality detection method based on working condition characteristics, which includes the following steps: ① adaptively selecting a time window or a sequence length by Fourier transform ② performing abnormality detection on a sequence by maximum average deviation ③ performing abnormality detection on a point by local outlier factor.

[0059] ① adaptively selecting a sequence length by Fourier transform

[0060] A sequence length is adaptively selected by Fourier transform.

[0061] The discrete Fourier transform of a time sequence composed of original data is expressed as follows:

[0062] wherein, is a discrete time domain signal, i.e. a time sequence composed of original data; is a corresponding frequency domain signal.

[0063] The index value corresponding to the maximum value of the frequency domain signal mode is used as the sequence length. If the index starts from 0, the index value plus 1 is used as the time window or the sequence length. The point abnormality detection is performed for the sequence length of 1, and the sequence abnormality detection is performed for the sequence length greater than 1. ② performing abnormality detection on a sequence by maximum average deviation

[0064] The maximum mean deviation is taken as a measure of sequence anomaly.

[0065] The maximum mean deviation value of the sequence to be detected and all other sequences is calculated, which is expressed as follows:

[0066] In the formula, is the sequence to be detected represents one of the other sequences except ; m is the sequence length obtained in ①; , , are the elements in the sequence, respectively; is the kernel function, and research shows that the Gaussian kernel function has better results, and its expression is: where > 0 is the width parameter of the Gaussian kernel function.

[0067] The maximum mean deviation value of and the other n sequences is taken, and the median is taken as the final result. According to the calculation formula, the MMD (Maximum Mean Discrepancy) value ranges from 0 to 1, and the longer the sequence, the more accurate the MMD calculation, so the sequence length is used to select the decision threshold, which is expressed as follows:

[0068] where, is the decision threshold, and when the MMD value exceeds the threshold, it is considered that the sequence of length m has appeared.

[0069] ③Anomaly detection of points by local outlier factor

[0070] The local outlier factor is taken as a measure of point anomaly.

[0071] The size of the neighborhood k is set, usually 20-100. For the point to be detected, the distance between it and the kth nearest neighbor is calculated as the k-distance, which is expressed as follows:

[0072] where, is the point to be detected, is the kth point closest to the point .

[0073] The reachable distance of the k nearest neighbors and the point is calculated, which is expressed as follows:

[0074] where, is the ith nearest neighbor, is the k-distance of .

[0075] The local reachable density is calculated, which is represented as follows:

[0076] Wherein, is the to-be-detected point and the reachable distance between the i-th neighbor point .

[0077] The local outlier factor is calculated, which is represented as follows:

[0078] LOF≈1, the to-be-detected point is similar to the neighbor density, and belongs to normal data; LOF>1, the to-be-detected point is lower than the neighbor density, and belongs to abnormal data. At the same time, the larger the number of neighbors k is, the more accurate the calculation is, so that the decision threshold is determined by the number of neighbors k, which is represented as follows:

[0079] Embodiment

[0080] Figure 1 is the total flowchart of the adaptive anomaly detection method based on working condition characteristics in the embodiment of the present application.

[0081] Step S1 acquires the historical data of each system, so as to construct the real sequence of each index.

[0082] In this embodiment, the data used for rationality verification is the use frequency and the change amount of use frequency of a device of a certain company in March 2015, and the data acquisition mode is: starting from 0:02, sampling every 5 minutes, 12 sampling points are generated in one hour, and 288 sampling points are generated in one day. The data set has a total of 8929 samples, of which the number of abnormal samples is 1588, and the specific data is shown in Table 1:

[0083] Table 1 Specific sampling data table

[0084]

[0085] In this embodiment, the use frequency and the change amount of use frequency are respectively subjected to anomaly detection according to the steps of the present application.

[0086] Step S2 determines the sequence length by Fourier transformation.

[0087] The result of Fourier transform on the click times is: [740863.00+0.00i, 66295.07-89223.44i, 121502.75+72859.18i, 72995.86+56195.70i, 159042.39-12103.33i, -58887.03+57787.34i, 92486.94+196322.67i, 88974.66+84872.11i, 47012.68+109385.17i, -49531.90+188136.50i, 82851.26+183753.88i, 3297.49+7266.54i, -42667.93+75360.16i, -74108.49+61372.73i, 9468.58+92904.92i, -103946.69-52930.01i, -116705.69+125613.51i, -53143.34-633.81i, -55702.21+38512.06i, -90193.11-76840.04i, -60736.98+76929.15i, 54395.58-83637.52i, -14365.31-37729.65i, -18702.42-75558.04i, -13079.85-22249.19i].

[0088] The corresponding amplitudes are: [740863.00, 111156.91, 141673.49, 92121.41, 159502.26, 82504.90, 217017.11, 122962.45, 119060.10, 194547.55, 201568.40, 7979.73, 86600.84, 96222.04, 93386.18, 116646.91, 171461.28, 53147.12, 67719.38, 118487.09, 98015.69, 99770.31, 40371.88, 77838.29, 25809.09].

[0089] The result of Fourier transform on the click number difference is: [155.00+0.00i, 217.80+46.63i, 52.56+171.09i, 36.51+154.24i, 189.70+447.66i, -48.70-2206.85i, -673.15+392.28i, -262.02+439.34i, -460.10+266.41i, -1037.61-309.95i, -1136.12+587.62i, 98.84+25.74i, -482.94-357.64i, -409.58-675.43i, -759.88+97.79i, 707.94-1100.23i, -1266.80-1306.13i, 158.77-635.83i, -337.31-702.51i, 1174.37-1212.84i, -933.77-847.23i, 1396.97+794.74i, 737.41-226.92i, 1375.51-312.61i, 528.91-224.08i]

[0090] The corresponding amplitudes are: [155.00, 222.74, 178.98, 158.50, 486.19, 2206.31, 779.12, 511.55, 531.66, 1082.91, 1279.09492764 102.14, 600.95, 789.91, 766.15, 1308.32, 1819.55, 655.35, 779.29, 1688.23, 1260.85, 1607.22, 771.54, 1410.59, 574.42].

[0091] In this embodiment, after Fourier transform, the sequence length of the number of uses is 1, and the sequence length of the change amount of the number of uses is 6. Therefore, the number of uses is subjected to step S4 for anomaly detection, and the change amount of the number of uses is subjected to step S3 for anomaly detection.

[0092] In step S3, the maximum average deviation is used to detect anomalies for the sequence length greater than 1.

[0093] In this embodiment, the change amount of the number of uses is subjected to this step.

[0094] This step S3 includes 4 sub-steps.

[0095] In step S3.1, the data is combined into a sequence according to the sequence length obtained in step S2.

[0096] In this embodiment, the combined sequence is:

[0097]

[0098] Because the sequence length is 6, from 2015 / 3 / 1 0:02 to 2015 / 3 / 1 0:22, five time points cannot form a sequence. Therefore, the sequence starts from 2015 / 3 / 1 0:27. The initial index is 0, so the index of the first sequence is 5.

[0099] Step S3.2, the maximum average deviation value of the sequence to be detected and other sequences is calculated, which is represented as follows:

[0100]

[0101] In the formula, is the sequence to be detected represents one of the other sequences except ; m is the sequence length obtained in ①, which is 6 in this embodiment; , , are elements in the sequence, respectively. is the kernel function, research shows that the Gaussian kernel function has better effect, its expression is: wherein > 0 is the width parameter of the Gaussian kernel function.

[0102] In this embodiment, the sequence to be detected is , and the maximum average deviation value calculated is [0.11, 0.056, 0.056, 0.111, 0.166, 0.2, 0.255, 0.29, 0.291, 0.292, 0.292, 0.355, 0.298, 0.355, 0.356, 0.376, 0.298, 0.278, 0.332, , 0.368, , 0.465]

[0103] Step S3.3, the median of the maximum average deviation value of and the other n sequences is taken as the final result.

[0104] In this embodiment, the final result is 0.368.

[0105] Step S3.4, according to the calculation formula, the range of MMD value is [0, 1], and the longer the sequence, the more accurate the MMD calculation, so the sequence length is selected to select the decision threshold, which is represented as follows:

[0106]

[0107] wherein, For the decision threshold, when the MMD value exceeds the threshold, it is considered that the sequence of length m is abnormal.

[0108] In this embodiment, the threshold is 0.267. Therefore, the sequence to be detected is an abnormal sequence.

[0109] In this embodiment, in order to verify the effectiveness of the present application, experiments are performed using actual data. The experiments are run on Python software.

[0110] In this embodiment, through step S2, it can be determined that the sequence length of the abnormality detection of the change amount of the number of uses is 6. Therefore, at each time point, the data of the past 25 minutes is needed. For example, at the time point 2015 / 3 / 10:27, the sequence composed of the change amount of the number of uses from 2015 / 3 / 10:02 to 2015 / 3 / 10:27 is needed.

[0111] When detecting, two methods can be adopted.

[0112] The first method is to detect once if the generated data is less than 1000 sequences, such as detecting once for each newly generated sequence. Then the maximum average deviation of the sequence to be detected and the 1000 newly generated sequences is calculated.

[0113] The second method is to detect once if the generated data is more than 1000, and then the maximum average deviation of each sequence and all other sequences generated in the same time period is calculated to detect the abnormality.

[0114] In this embodiment, the data obtained is more than 1000, so the second method is adopted to detect the abnormality. The test results are shown in Table 2 below:

[0115] Table 2 Test results table

[0116]

[0117] Step S4: Detecting point abnormality of sequence length 1 by local outlier factor.

[0118] In this embodiment, the step is performed on the change amount of the number of uses.

[0119] This step S4 includes 6 sub-steps.

[0120] Step S4.1, set the size of the neighborhood k, usually 20-100.

[0121] Step S4.2, for the point to be detected, calculate the distance between it and the kth nearest neighbor as the k-distance, which is represented as follows:

[0122]

[0123] wherein, is the point to be detected, is the distance of the kth nearest point to the point.

[0124] Step S4.3, the reachable distance of the k nearest points to the point is calculated, which is expressed as follows:

[0125]

[0126] wherein, is the jth nearest point, is the k distance of .

[0127] Step S4.4, the local reachable density is calculated, which is expressed as follows:

[0128]

[0129] wherein, is the reachable distance between the point to be detected and the jth nearest point .

[0130] Step S4.5, the local outlier factor is calculated, which is expressed as follows:

[0131]

[0132] Step S4.6, LOF≈1, the point to be detected is similar to the neighbor density and belongs to normal data; LOF>1, the point to be detected is lower than the neighbor density and belongs to abnormal data. At the same time, the larger the number of nearest neighbors k is, the more accurate the calculation is, so the decision threshold is determined by the number of nearest neighbors k, which is expressed as follows:

[0133]

[0134] In the embodiment of the present application, the neighborhood K is set to 20, 50 and 100 respectively.

[0135] When detection is performed, two methods can be adopted.

[0136] The first method is that if the generated data is less than 10K, detection is performed once, for example, detection is performed once every time a new data point is generated, so the local outlier factor of the sequence to be detected and the last 10K sequences is calculated.

[0137] Second, if the generated data is greater than 10K, then the local outlier factor of each point with all other points generated in the same time period is calculated to perform anomaly detection.

[0138] The data obtained in this embodiment is more than 10K, so the second method is adopted to perform anomaly detection.

[0139] In this embodiment, when the field K is set to 20, the 832nd point, i.e. the data at 2015 / 3 / 3 21:22:53, is taken as an example, and the number of clicks at this time is 865.

[0140] The K nearest points to it are [7416, 2529, 2523, 4335, 8570, 4337, 8880, 8844, 2515, 4336, 2498, 2518, 7665, 4334, 2524, 8849, 2510, 2513, 2526].

[0141] The distances are [7.0, 9.0, 19.0, 19.0, 21.0, 27.0, 37.0, 38.0, 43.0, 48.0, 68.0, 85.0, 85.0, 92.0, 111.0, 112.0, 114.0, 116.0, 131.0].

[0142] The reachable distances are [137.0, 135.0, 135.0, 131.0, 135.0, 138.0, 129.0, 130.0, 128.0, 151.0, 103.0, 95.0, 95.0, 131.0, 111.0, 112.0, 135.0, 137.0, 150.0].

[0143] The local reachable distance is 0.00786.

[0144] The local outlier factor is 0.9859.

[0145] The threshold is 0.95, so the data at this time is abnormal data.

[0146] The test results are shown in Table 3 below.

[0147] Table 3 Test results table

[0148]

[0149] Effects of the embodiments

[0150] According to the self-adaptive abnormality detection method based on working condition characteristics provided by the embodiment, the sequence length is determined by Fourier transform. The maximum average deviation algorithm is used for abnormality detection for the sequence length greater than 1, and the local outlier factor algorithm is used for abnormality detection for the sequence length equal to 1. Therefore, the problem that the sequence length for abnormality detection in industrial production is always determined according to an empirical value is solved.

[0151] The preferred embodiments of the application have been specifically described above, but the application is not limited to the embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the application. These equivalent modifications or replacements are all included in the scope of the application.

Claims

1. A method of adaptive anomaly detection based on operating condition characteristics, characterized by, Comprising: S1, obtaining working condition historical data, and constructing a sequence of the working condition historical data; S2, adaptively selecting the length of the sequence through Fourier transformation; if the length of the sequence is greater than 1, then entering step S3, if the length of the sequence is equal to 1, then entering step S4; S3, performing anomaly detection on the sequence with the length greater than 1 through the maximum average deviation and outputting the result; S4, performing anomaly detection on the sequence with the length equal to 1 through the local outlier factor and outputting the result; Step S2 comprises: S2.1, performing discrete Fourier transformation on the sequence formed by the historical data, satisfying: wherein is a discrete-time domain signal, i.e. a sequence of raw data, N is the length of the sequence of raw data; is a discrete sequence in the frequency domain, representing the spectral components of the signal at frequencies e is the natural constant, i is the imaginary unit; S2.2, using the index value corresponding to the maximum value of the frequency domain signal module as the sequence length, if the index starts from 0, then using the index value plus 1 as the length of the time window or the sequence; S2.3, if the length of the sequence is equal to 1, then entering step S4; if the length of the sequence is greater than 1, then entering step S3.

2. The method of claim 1, wherein, Step S3 comprises: S3.1, combining the data into a sequence according to the sequence length obtained in step S2, for each time point t, combining the data from t-freq to t into a sequence, wherein freq is the sequence length obtained in step S2; S3.2, calculating the maximum average deviation value of the to-be-detected sequence and all other sequences, satisfying: In the formula, is a sequence to be detected, is one of other sequences except MMD is the maximum mean deviation, and m is the length of the sequence solved in S2; is the jth element in the sequence x to be detected, is the kth element in the sequence to be detected, is the jth element in the sequence is the kth element in the sequence is the jth element in the sequence is the kth element in the sequence; is a kernel function; S3.3, taking the median of the maximum average deviation values of the to-be-detected sequence and other sequences as the final result; S3.4, the decision threshold is selected by the length of the sequence When the value of the maximum average deviation exceeds the decision threshold then the sequence is determined to be abnormal, the decision threshold satisfies: wherein is the decision threshold and m is the length of the sequence found in S2.

3. The method of claim 2, wherein, In step S3.4, the value of the maximum average deviation satisfies [0, 1]. 4.The condition-feature-based adaptive anomaly detection method of claim 2, wherein, In step S3.2, the kernel function satisfies: wherein is a width parameter of the Gaussian kernel function, >

0.

5. The method of claim 1, wherein, Step S4 comprises: S4.1, selecting a neighborhood k; S4.2, calculating the distance of the nearest neighbor of the to-be-detected point and the kth neighboring point, satisfying: wherein, is the distance is the distance is the distance S4.3, calculate the reachable distance of the k nearest points and the point to be detected satisfies: wherein, is the jth nearest neighbor point, is is the distance to the nearest neighbor of the kth nearest neighbor point. S4.4, calculating the local reachable density, satisfying: wherein, is the reachable distance between the point to be detected and the jth neighbor point and the jth neighbor point S4.5, calculating the local outlier factor, satisfying: where k is the size of the neighborhood, is the local reachable density of the point p to be detected; is the local reachable density of the jth nearest neighbor point of the point p to be detected. S4.6, determining a decision threshold , decision threshold is satisfied: S4.7, if LOF ≈ 1, indicating the point to be detected with similar neighbor density, then it is determined to be normal data; if LOF > 1, indicating the point to be detected is lower than the neighbor density, then it is determined to be abnormal data.

6. The method of claim 5, wherein, In step S4.1, the value of the neighborhood K satisfies [10, 100].

7. An adaptive anomaly detection system based on operating condition characteristics, characterized by, Comprising: A collection module for obtaining working condition historical data and constructing a sequence of the working condition historical data; A change module for obtaining the length of the sequence through Fourier transformation; If the length of the sequence is greater than 1, then performing anomaly detection on the sequence with the length greater than 1 through the maximum average deviation, if the length of the sequence is equal to 1, then performing anomaly detection on the sequence with the length equal to 1 through the local outlier factor; A first detection module for performing anomaly detection on the sequence with the length greater than 1 through the maximum average deviation and outputting the result; A second detection module for performing anomaly detection on the sequence with the length equal to 1 through the local outlier factor and outputting the result; The step of the change module for obtaining the length of the sequence through Fourier transformation comprises: Performing discrete Fourier transformation on the sequence formed by the historical data, satisfying: wherein is a discrete-time domain signal, i.e. a sequence of raw data, N is the length of the sequence of raw data; is a discrete sequence in the frequency domain, representing the spectral components of the signal at frequencies e is the natural constant, i is the imaginary unit; Using the index value corresponding to the maximum value of the frequency domain signal module as the sequence length, if the index starts from 0, then using the index value plus 1 as the length of the time window or the sequence; If the length of the sequence is equal to 1, then performing anomaly detection on the sequence with the length equal to 1 through the local outlier factor and outputting the result; if the length of the sequence is greater than 1, then performing anomaly detection on the sequence with the length greater than 1 through the maximum average deviation and outputting the result.

8. An adaptive anomaly detection apparatus based on operating condition characteristics, characterized by Comprising: A memory storing an adaptive abnormality detection method program based on working condition characteristics, and a processor for running the adaptive abnormality detection method program based on working condition characteristics, the adaptive abnormality detection method program based on working condition characteristics being configured to implement the steps of the adaptive abnormality detection method based on working condition characteristics as claimed in any one of claims 1 to 6.

9. A computer readable storage medium, characterized in that, A computer readable storage medium storing an adaptive abnormality detection method program based on working condition characteristics, the adaptive abnormality detection method program based on working condition characteristics being configured to implement the steps of the adaptive abnormality detection method based on working condition characteristics as claimed in any one of claims 1 to 6 when executed by a processor.

Images